sushi-com[.]cyou

Analysis of the domain sushi-com.cyou indicates a recent cryptocurrency‑related impersonation campaign targeting the SushiSwap brand. The domain was registered on 28 September 2025 through Dynadot LLC and is currently hosted on the IP address 142.250.185.100, which belongs to AS15169 Google LLC and resolves to a Google‑owned server located in the United States. DNS resolution uses Cloudflare’s authoritative name servers apollo.ns.cloudflare.com and meera.ns.cloudflare.com, suggesting the attacker leveraged Cloudflare’s infrastructure for resilience. No TLS certificate is presented, leaving the site exposed to unencrypted HTTP connections.

The only observable page metadata is a generic title “Google”, providing no direct evidence of a spoofed login page or malicious payload. Reputation services rate the domain poorly: Gridinsoft assigns a trust score of 0 / 100, and six of ninety‑five VirusTotal scanners flag it as malicious. The domain is listed on four public blocklists and has been added to the blocklists of PhishDestroy, Polkadot, Enkrypt, and Codeesura. The site’s current status is offline, which may indicate takedown or temporary suspension.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the IP address to any existing deny lists. Because the site lacks an SSL certificate and presents only a generic title, automated content analysis cannot confirm the exact phishing page layout, so the threat remains partially observable. Ongoing vigilance is recommended, especially for users of SushiSwap who may receive unsolicited links referencing this domain.